moparisthebest/sslh
1
0
Fork 0
mirror of https://github.com/moparisthebest/sslh synced 2024-11-23 17:42:22 -05:00
Code Issues Releases Wiki Activity

libcap support: print out process capabilities at startup if verbose

Browse Source
This commit is contained in:
Yves Rutschle 2014-02-09 21:39:27 +01:00
parent 2d3b6c4abd
commit 6bcb5c83f2
4 changed files with 33 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ChangeLog
View File

@ -5,6 +5,12 @@ vNEXT:
first incoming packet. first incoming packet.
(Ondrej Kuzník) (Ondrej Kuzník)
Libcap support: Keep only CAP_NET_ADMIN if started
as root with transparent proxying and dropping
priviledges (enable USELIBCAP in Makefile). This
avoids having to mess with filesystem capabilities.
(Sebastian Schmidt/yath)
Fixed bugs related to getpeername that would cause Fixed bugs related to getpeername that would cause
sslh to quit erroneously (getpeername can return sslh to quit erroneously (getpeername can return
actual errors if connections are dropped before actual errors if connections are dropped before

5
common.c
View File

@ -37,11 +37,6 @@ struct addrinfo *addr_listen = NULL; /* what addresses do we listen to? */
int allow_severity =0, deny_severity = 0; int allow_severity =0, deny_severity = 0;
#endif #endif
#ifdef LIBCAP
#include <sys/prctl.h>
#include <sys/capability.h>
#endif
/* check result and die, printing the offending address and error */ /* check result and die, printing the offending address and error */
void check_res_dumpdie(int res, struct addrinfo *addr, char* syscall) void check_res_dumpdie(int res, struct addrinfo *addr, char* syscall)
{ {

6
common.h
View File

@ -27,6 +27,12 @@
#include <libgen.h> #include <libgen.h>
#include <time.h> #include <time.h>
#include <getopt.h> #include <getopt.h>
#ifdef LIBCAP
#include <sys/prctl.h>
#include <sys/capability.h>
#endif
#include "version.h" #include "version.h"
#define CHECK_RES_DIE(res, str) \ #define CHECK_RES_DIE(res, str) \

21
sslh-main.c
View File

@ -91,6 +91,23 @@ static void print_usage(void)
fprintf(stderr, USAGE_STRING, prots); fprintf(stderr, USAGE_STRING, prots);
} }
static void printcaps(void) {
#ifdef LIBCAP
cap_t caps;
char* desc;
ssize_t len;
caps = cap_get_proc();
desc = cap_to_text(caps, &len);
fprintf(stderr, "capabilities: %s\n", desc);
cap_free(caps);
cap_free(desc);
#endif
}
static void printsettings(void) static void printsettings(void)
{ {
char buf[NI_MAXHOST]; char buf[NI_MAXHOST];
@ -508,9 +525,13 @@ int main(int argc, char *argv[])
if (user_name) if (user_name)
drop_privileges(user_name); drop_privileges(user_name);
/* Open syslog connection */ /* Open syslog connection */
setup_syslog(argv[0]); setup_syslog(argv[0]);
if (verbose)
printcaps();
main_loop(listen_sockets, num_addr_listen); main_loop(listen_sockets, num_addr_listen);
return 0; return 0;